| HTTP/2 rapid reset can cause excessive work in net/httpCVE-2023-39325 · GHSA-4374-P667-P6C8Version ranges need review. |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| github.com/containers/image allows unexpected authenticated registry accessesCVE-2024-3727 · GHSA-6WVF-F2VW-3425Version ranges need review. |
github.com/containers/image/v5github.com/containers/image |
GoRed Hat |
High
|
Fix reported |
|
| pgx SQL Injection via Line Comment CreationCVE-2024-27289 · GHSA-M7WR-2XF7-CM9PVersion ranges need review. |
github.com/jackc/pgx/v4github.com/jackc/pgx |
GoRed Hat |
High
|
Fix reported |
|
| Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)CVE-2024-28180 · GHSA-C5Q2-7R4C-MV6GVersion ranges need review. |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
Medium
|
Fix reported |
|
| Moby (Docker Engine) started with non-empty inheritable Linux process capabilitiesCVE-2022-24769 · GHSA-2MM7-X5H6-5PVQVersion ranges need review. |
github.com/docker/dockergithub.com/moby/moby |
GoRed Hat |
Medium
|
Fix reported |
|
| Supplementary groups are not set up properly in github.com/containerd/containerdCVE-2023-25173 · GHSA-HMFX-3PCX-653PVersion ranges need review. |
github.com/containerd/containerdCryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/text/language Denial of service via crafted Accept-Language headerCVE-2022-32149 · GHSA-69CH-W2M2-3VJPVersion ranges need review. |
golang.org/x/textOpenShift Developer Tools and Services/odo |
GoRed Hat |
High
|
Fix reported |
|
| Uncontrolled Resource Consumption in promhttpCVE-2022-21698 · GHSA-CG3Q-J54F-5P7PVersion ranges need review. |
github.com/prometheus/client_golangCost Management Metrics Operator/costmanagement-metrics-operator-container |
GoRed Hat |
High
|
Fix reported |
|
| Stack exhaustion in Parse in go/build/constraintCVE-2024-34158 · GO-2024-3107 |
stdlibMachine Deletion Remediation Operator/workload-availability/machine-deletion-remediation-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Clarify Content-Type handlingCVE-2021-41190 · GHSA-MC8V-MGRF-8F4M |
github.com/opencontainers/distribution-specRed Hat Enterprise Linux 8/container-tools:2.0/buildah |
GoRed Hat |
Low
|
Fix reported |
|
| HTTP/2 Stream Cancellation AttackCVE-2023-44487 · GHSA-QPPJ-FM5R-HXR3 |
golang.org/x/netcom.typesafe.akka:akka-http-core |
GoMavenRed HatSwift |
Medium
|
Fix reported |
|
| Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netipCVE-2024-24790 · GO-2024-2887 |
stdlibBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-waiters-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Command Injection Vulnerability with Mercurial in VCSCVE-2022-21235 · GHSA-6635-C626-VJ4RVersion ranges need review. |
github.com/Masterminds/vcsOpenShift Serverless/openshift-serverless-1/ingress-rhel8-operator |
GoRed Hat |
Critical
|
Fix reported |
|
| pgx SQL Injection via Protocol Message Size OverflowCVE-2024-27304 · GHSA-MRWW-27VC-GGHV |
github.com/jackc/pgx/v4github.com/jackc/pgx/v5 |
GoRed Hat |
High
|
Fix reported |
|
| Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictionsCVE-2022-36109 · GHSA-RC4R-WH2Q-Q6C4Version ranges need review. |
github.com/docker/dockerMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Stack exhaustion in all Parse functions in go/parserCVE-2024-34155 · GO-2024-3105 |
stdlibBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-waiters-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm vulnerable to information disclosure via getHostByName Function CVE-2023-25165 · GHSA-PWCW-6F5G-GXF8Version ranges need review. |
helm.sh/helm/v3Cryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| net/http, x/net/http2: close connections when receiving too many headersCVE-2023-45288 · GHSA-4V7X-PQXF-CX7MVersion ranges need review. |
golang.org/x/net/http2golang.org/x/net |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/net/html Infinite Loop vulnerabilityCVE-2021-33194 · GHSA-83G2-8M93-V3W7Version ranges need review. |
golang.org/x/netLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel8-operator |
GoRed Hat |
High
|
Fix reported |
|
| Denial of service due to improper 100-continue handling in net/httpCVE-2024-24791 · GO-2024-2963 |
stdlibBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-waiters-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
